Social media research group Graphika said today it identified a Twitter botnet of around 3,000 bots that pushed pro-Chinese political spam, echoing official messaging released through state propaganda accounts.
Graphika said it was able to identify the botnet due to a quirk shared by the vast majority of bot accounts, most of which used quotes from Bram Stoker’s Dracula book for the profile description and the first two tweets.
Image: Graphika
Graphika said the Dracula botnet, as they named this cluster of fake accounts, exhibited multiple similarities to past Twitter botnets that were part of Spamouflage — a codename the company has given to the Chinese government’s social media influence operations, which Graphika had previously exposed in September 2019, April 2020, and August 2020.
However, unlike previous operations, the Graphika team discovered this botnet early, with the botnet only managing to amass 3,000 accounts, and with the oldest accounts dating back only one month, to July 2020.
Graphika said the accounts were not dangerous in themselves, as they appeared to be automated, either quoting Dracula or replying to each other’s tweets. However, the company said the accounts were used to amplify tweets and get predetermined topics trending, topics that could have been used to promote Chinese state propaganda, usually depicting a skewed view of reality, favorable to Beijing’s international affairs.
The botnet has been down since August 20, according to Ben Nimmo, a Graphika investigator.
In a blog post today, Nimmo said Twitter intervened and suspended the vast majority of Twitter Dracula botnet accounts, while also marking the others that were not taken down as “restricted,” preventing them from posting new content.
At the time of writing, it remains unclear if the accounts were suspended programmatically by Twitter’s algorithm, or if Twitter’s staff had also spotted the same botnet and manually intervened. A Twitter spokesperson did not return a request for comment seeking additional details and an official statement.
Credit: Zdnet
